SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.

Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.

Plus Atlanta, Bangalore, Singapore and Barcelona all in the next 90 days. For a list of all upcoming events, on-line and live: http://www.sans.org/index.php ****************************************************************************

Germany's Interior Ministry has announced that it will establish a National Cyber Defense Center next year. Government spokesperson Stefan Paris said that government systems recorded 1,600 attacks in the first six months of 2010, a significant increase over the 900 attacks reported in all of 2009. Paris acknowledged that there were likely many more attacks that were not detected. The government believes the majority of the attacks originated in China. -http://uk.reuters.com/article/idUKTRE6BQ2JS20101227-http://www.google.com/hostednews/afp/article/ALeqM5hNZEw4FdQReC4SDVsk0KxGwp1png?docId=CNG.742e6f8c140c9fad9f90528e14966d4e.1c1[Editor's Note (Cole): The awareness that so many attacks are not detected is a wakeup call to look more closely at the traffic that is leaving your network, identifying anomalies or strange patterns in the traffic. Since many organizations are broken into and do not realize it, the more proactive you are the better. Prevention is important, but detection is a must. ]

A Missouri escrow company is suing BancorpSouth Bank for failing to take adequate precautions against unauthorized funds transfers. Choice Escrow lost US $440,000 from their BancorpSouth account to cyber thieves, and the bank has refused to refund the money. The company's director of business development, Jim A. Payne, is urging legislators at the state and federal level to pass laws that would force banks that do not implement effective security measures to cover losses from unauthorized transfers from commercial accounts. Cyber security blogger Brian Krebs broke the story more than a month ago. He observed that banks often blame the clients for the thefts, saying that it's their fault for allowing their computers to become infected with malware. But Krebs says that "any security or authentication mechanism that does not start with the assumption that the customer's system is already compromised by malicious software does not have a prayer of defeating today's malicious attacks." -http://krebsonsecurity.com/2010/11/escrow-co-sues-bank-over-440k-cyber-theft/-http://www.news-leader.com/article/20101226/BUSINESS/12260323/Hacker-blamed-for-theft[Editor's Note (Schultz): I agree with Krebs. Financial institutions should assume the worst case when it comes to security in customer computers and should at a minimum provide customers with software and/or services that provide a high amount of assurance that these computers have not been compromised. (Ranum): The bank performing the transaction cannot reasonably be expected to assume responsibility for an endpoint they have no ability to control. Legislating that banks "implement effective security measures" is nonsensical, since 'effective' measures would have to include things that are not widely in use today because they are considered onerous. ]

FCC's Net Neutrality Rules to Face Hurdles (December 26, 2010)

The net neutrality rules approved by the US Federal Communications Commission (FCC) last week are likely to face legal challenges and attempts by Republican lawmakers to repeal them. The question is not whether the rules will be challenged in court, but rather, who will file the lawsuit. The key legal question is likely to be whether the FCC has the authority to establish the rules. An April ruling from the US Court of Appeals for the District of Columbia Circuit curtailed the FCC's effort to enforce net neutrality in a case involving Comcast. -http://www.pcworld.com/businesscenter/article/214936/whats_next_for_the_fcc_and_net_neutrality.html

Researchers are discovering that new gadgets designed to connect to the Internet, such as smartphones and certain HDTVs, are not always being designed with security in mind. Hackers shifting their focus to these devices is inevitable as the Internet-ready gadgets become more and more ubiquitous. Protecting the devices from attacks will also require new approaches. In some cases, the volume of mobile phone apps offered makes it impossible to vet them all adequately. -http://www.nytimes.com/2010/12/27/technology/27hack.html?_r=1&ref=technology[Editor's Note (Schultz): Saying that security is not always a consideration in Web connected devices is a gross understatement. Because mobile device applications are intended for single-user contexts, there is little or no authentication and authorization in most of these applications. Critical security functions such as data encryption and auditing are also almost always missing. (Cole): With the holiday season wrapping up this is a good time to remind your family to do a few important things with regard to security: 1) turn off Bluetooth and other services that are not needed; 2) always run some form of security on your wireless; 3) put any web enabled devices behind a firewall or filtering device. ]

Eugene Schultz, Ph.D., CISM, CISSP is CTO of Emagined Security and the author/co-author of books on Unix security, Internet security, Windows NT/2000 security, incident response, and intrusion detection and prevention. He was also the co-founder and original project manager of the Department of Energy's Computer Incident Adv isory Capability (CIAC)

John Pescatore is Vice President at Gartner Inc.; he has worked in computer and network security since 1978.

Stephen Northcutt founded the GIAC certification and currently serves as President of the SANS Technology Institute, a post graduate level IT Security College, www.sans.edu.

Dr. Johannes Ullrich is Chief Technology Officer of the Internet Storm Center and Dean of the Faculty of the graduate school at the SANS Technology Institute.

Ed Skoudis is co-founder of Inguardians, a security research and consulting firm, and author and lead instructor of the SANS Hacker Exploits and Incident Handling course.

Rob Lee is the curriculum lead instructor for the SANS Institute's computer forensic courses (computer-forensics.sans.org) and a Director at the incident response company Mandiant.

Rohit Dhamankar is a security professional currently involved in independent security research.

Tom Liston is a Senior Security Consultant and Malware Analyst for Inguardians, a handler for the SANS Institute's Internet Storm Center, and co-author of the book Counter Hack Reloaded.

Dr. Eric Cole is an instructor, author and fellow with The SANS Institute. He has written five books, including Insider Threat and he is a founder with Secure Anchor Consulting.

Ron Dick directed the National Infrastructure Protection Center (NIPC) at the FBI and is the incoming President of the InfraGard National Members Alliance - with 22,000 members.

Mason Brown is one of a very small number of people in the information security field who have held a top management position in a Fortune 50 company (Alcoa). He is leading SANS' global initiative to improve application security.

David Hoelzer is the director of research & principal examiner for Enclave Forensics and a senior fellow with the SANS Technology Institute.

Marcus J. Ranum built the first firewall for the White House and is widely recognized as a security products designer and industry innovator.

Clint Kreitner is the founding President and CEO of The Center for Internet Security.

Brian Honan is an independent security consultant based in Dublin, Ireland.

David Turley is SANS infrastructure manager and serves as production manager and final editor on SANS NewsBites.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit http://portal.sans.org/